Does the order of headers in an HTTP response ever matter?

by

No, it does not matter for headers with different names. See RFC 2616, section 4.2:

The order in which header fields with differing field names are
received is not significant. However, it is “good practice” to send
general-header fields first, followed by request-header or response-
header fields, and ending with the entity-header fields.

It DOES matter, however, for multiple headers with the same name:

Multiple message-header fields with the same field-name MAY be
present in a message if and only if the entire field-value for that
header field is defined as a comma-separated list [i.e., #(values)].
It MUST be possible to combine the multiple header fields into one
“field-name: field-value” pair, without changing the semantics of the
message, by appending each subsequent field-value to the first, each
separated by a comma. The order in which header fields with the same
field-name are received is therefore significant to the
interpretation of the combined field value, and thus a proxy MUST NOT
change the order of these field values when a message is forwarded.

More Related Contents:

  1. 403 Forbidden vs 401 Unauthorized HTTP responses
  2. How can I view HTTP headers in Google Chrome?
  3. What is http multipart request?
  4. What’s the “Content-Length” field in HTTP header?
  5. What character encoding should I use for a HTTP header?
  6. Axios get access to response header fields
  7. Best HTTP Authorization header type for JWT
  8. What exactly does the Access-Control-Allow-Credentials header do?
  9. Are Duplicate HTTP Response Headers acceptable?
  10. Operating System from User-Agent HTTP Header [closed]
  11. Can I rely on Referer HTTP header?
  12. JMeter Alter HTTP Headers During Test
  13. Is this statement correct? HTTP GET method always has no message body
  14. what’s the difference between Expires and Cache-Control headers?
  15. What are Content-Language and Accept-Language?
  16. Proper MIME media type for PDF files
  17. S3 – Access-Control-Allow-Origin Header
  18. How to prevent my site page to be loaded via 3rd party site frame of iFrame
  19. Is there a practical HTTP Header length limit?
  20. Difference between Content-Range and Range headers?
  21. Adding a custom header to HTTP request using angular.js
  22. How can I read the current headers without making a new request with JS? [duplicate]
  23. Does the HTTP Protocol support multiple content types in response headers?
  24. Difference between no-cache and must-revalidate for Cache-Control?
  25. What is the http-header “X-XSS-Protection”?
  26. Is the Content-Length header required for a HTTP/1.0 response?
  27. How to add headers to OkHttp request interceptor?
  28. How to get host name with port from a http or https request
  29. How to properly use Bearer tokens?
  30. Can’t get rid of header X-Powered-By:Express

Leave a Comment